使用Bitnami Helm Chart部署Kafka后生产者SASL认证失败

问题概述 #

使用Bitnami Kafka Helm Chart（版本26.4.3，对应Kafka 3.6.0）部署3节点Kafka集群，所有Pod均正常运行，但按照安装输出指引配置client.properties并启动Kafka生产者时，出现SASL SCRAM-SHA-256认证失败错误。

环境信息 #

• Helm Chart版本：26.4.3
• Kafka版本：3.6.0
• 集群状态：3个kafka-controller Pod均为Running状态（2/2就绪）
• 命名空间：develop

配置与执行细节 #

按指引创建的client.properties内容 #

security.protocol=SASL_PLAINTEXT
sasl.mechanism=SCRAM-SHA-256
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required \
    username="user1" \
    password="$(kubectl get secret kafka-user-passwords --namespace develop -o jsonpath='{.data.client-passwords}' | base64 -d | cut -d , -f 1)";

执行的生产者命令 #

kafka-console-producer.sh \
    --producer.config /tmp/client.properties \
    --broker-list kafka-controller-0.kafka-controller-headless.develop.svc.cluster.local:9092,kafka-controller-1.kafka-controller-headless.develop.svc.cluster.local:9092,kafka-controller-2.kafka-controller-headless.develop.svc.cluster.local:9092 \
    --topic test

错误日志 #

生产者端错误 #

[2023-12-04 14:06:37,028] ERROR [Producer clientId=console-producer] Connection to node -3 (kafka-controller-2.kafka-controller-headless.develop.svc.cluster.local/10.1.63.93:9092) failed authentication due to: Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-256 (org.apache.kafka.clients.NetworkClient)
[2023-12-04 14:06:37,028] WARN [Producer clientId=console-producer] Bootstrap broker kafka-controller-2.kafka-controller-headless.develop.svc.cluster.local:9092 (id: -3 rack: null) disconnected (org.apache.kafka.clients.NetworkClient)
[2023-12-04 14:06:37,571] ERROR [Producer clientId=console-producer] Connection to node -2 (kafka-controller-1.kafka-controller-headless.develop.svc.cluster.local/10.1.63.89:9092) failed authentication due to: Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-256 (org.apache.kafka.clients.NetworkClient)

Kafka Broker端错误 #

[2023-12-04 14:06:41,955] INFO [SocketServer listenerType=BROKER, nodeId=0] Failed authentication with /10.1.63.92 (channelId=10.1.63.90:9092-10.1.63.92:55104-1) (Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-256) (org.apache.kafka.common.network.Selector)

Broker的SASL核心配置片段 #

sasl.enabled.mechanisms = [PLAIN, SCRAM-SHA-256, SCRAM-SHA-512]
sasl.mechanism.controller.protocol = PLAIN
sasl.mechanism.inter.broker.protocol = PLAIN

已尝试的排查动作 #

尝试覆盖Helm Chart的SASL相关配置，问题未解决。

解决思路建议 #

1. 修正client.properties中的密码配置
   kafka-client容器内无法解析shell命令，需先在集群外部执行密码获取命令，将实际密码填入配置文件：

   • 本地执行命令获取密码：

     kubectl get secret kafka-user-passwords --namespace develop -o jsonpath='{.data.client-passwords}' | base64 -d | cut -d , -f 1
     

   • 将输出的实际密码替换client.properties中的$(...)部分，修改后内容示例：

     sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required \
         username="user1" \
         password="实际获取的密码";
     

   • 重新复制修改后的配置文件到kafka-client容器再测试。

2. 验证用户存在性
   确认Kafka中已创建user1用户，可通过查看Broker启动日志或执行Kafka用户管理命令核实。

3. 检查Listener认证配置
   确认Helm Chart的listeners.client.sasl.enabledMechanisms配置包含SCRAM-SHA-256，保证CLIENT listener启用了对应认证机制。

4. 核对Secret与Kafka凭证一致性
   确认kafka-user-passwords Secret中的密码与Kafka存储的SCRAM凭证一致，若部署过程中Secret被意外修改会导致认证失败。

内容的提问来源于stack exchange，提问作者user2815908